agent-dag 3.22.0 → 3.22.3

package/src/server/claude-dir.mjs

@@ -1,213 +0,0 @@
-// Where Claude Code lives on this machine: its configuration directory, its
-// binary, and the question of whether it is here at all.
-//
-// CLAUDE_CONFIG_DIR relocates that directory wholesale; it is a replacement for
-// ~/.claude, not an overlay, so on a machine where it is set there is nothing in
-// ~/.claude for Claude Code to read. Writing hook entries there is silent
-// failure of the worst kind: the install reports success, no hook ever fires,
-// and the deck stays empty with no error anywhere to explain it.
-//
-// Every module on the Claude side of the install resolves the directory through
-// here, so the deck can never register its hooks in one file while Claude Code
-// reads another. hook/hook.js repeats the rule inline rather than importing it:
-// it is copied out of the package and run standalone by the host CLI, so it has
-// no way back to this module, but it has to resolve the same directory.
-//
-// The binary list and the presence test moved in beside it for the same reason.
-// The list used to sit in quota.mjs under the name quotaClaudeCandidates, where
-// it read as a detail of one poller; it is nothing of the kind. It is the answer
-// to "where does the `claude` command live", and the deck now asks that question
-// at boot, before any quota exists, to decide whether this is a Claude machine
-// at all. One list, one caller-visible name, no second spelling to drift.
-import { existsSync } from "node:fs";
-import { homedir } from "node:os";
-import { join, resolve, posix as posixPath, win32 as winPath } from "node:path";
-
-/**
- * Absolute path of the Claude Code config dir: $CLAUDE_CONFIG_DIR or ~/.claude.
- *
- * The environment and the home directory are parameters purely so callers that
- * are already working from an injected environment can stay consistent with it;
- * every caller in the deck passes nothing and gets the real machine's answer.
- */
-export function claudeConfigDir(env = process.env, home = homedir()) {
-  const override = env.CLAUDE_CONFIG_DIR?.trim();
-  return override ? resolve(override) : join(home, ".claude");
-}
-
-/**
- * Every place the `claude` CLI is known to live, in the order to try them.
- *
- * Pure, and the platform, environment and home directory are parameters, so the
- * Windows list can be checked from a Mac — which is the only way this list stays
- * right, since it exists entirely for machines the author is not sitting at.
- */
-export function claudeCliCandidates(platform = process.platform, env = process.env, home = homedir()) {
-  // The path flavour follows the PLATFORM ARGUMENT, not the host: node's `join`
-  // would emit forward slashes when the Windows list is built on a Mac.
-  const { join } = platform === "win32" ? winPath : posixPath;
-  if (platform !== "win32") {
-    return [
-      "claude",
-      join(home, ".local", "bin", "claude"),
-      "/usr/local/bin/claude",
-      "/opt/homebrew/bin/claude",
-    ];
-  }
-  return [
-    // The native installer, which ships a bare claude.exe and NO .cmd shim. It
-    // was the one install this branch could not reach: the npm path below does
-    // not exist on such a machine, and the bare-name fallback used to be spelled
-    // `claude.cmd`, which cmd.exe cannot resolve to an .exe — PATHEXT supplies a
-    // missing extension, it never substitutes one that is already there.
-    join(home, ".local", "bin", "claude.exe"),
-    // `npm i -g @anthropic-ai/claude-code`. npm's global prefix is %APPDATA%\npm
-    // — Roaming rather than Local, deliberately, since it follows the user
-    // between machines — and APPDATA is read from the environment because a
-    // roaming profile puts it on a network share, not under the home directory.
-    join(env.APPDATA || join(home, "AppData", "Roaming"), "npm", "claude.cmd"),
-    // Last resort: the bare name, which cmd.exe resolves through PATH + PATHEXT
-    // and so finds claude.exe and claude.cmd alike.
-    "claude",
-  ];
-}
-
-/**
- * The names Claude Code itself writes inside its config dir, and the deck never
- * does. Presence of any one of them is proof Claude Code has actually run here.
- *
- * The exclusions are the entire point. `settings.json` and `agent-dag/` are OURS
- * — installHooks writes the first and keepDiscovery creates the second — so a
- * test that accepted them would answer "Claude is installed" on any machine this
- * deck had ever been started on, including the Codex-only one this whole check
- * exists to recognise. That is not a hypothetical: every Codex-only machine that
- * ran an earlier ccdeck already has both sitting in a ~/.claude the deck created
- * for itself.
- *
- * `.credentials.json` is in the list but cannot carry it alone: macOS keeps the
- * OAuth token in the Keychain and writes no such file, so on the platform where
- * a credentials test is most tempting it is always negative (see #360). It earns
- * its place as one more way to say yes on Linux and Windows, never as the test.
- */
-const CLAUDE_USE_MARKERS = [
-  "projects",         // one directory per cwd, written from the first session on
-  "history.jsonl",    // the prompt history, appended to on the first prompt
-  "statsig",          // written at first launch, before any session completes
-  "todos",
-  "shell-snapshots",
-  "ide",
-  "plugins",
-  ".credentials.json", // Linux + Windows OAuth store; absent on macOS by design
-  ".claude.json",      // Claude Code's own state file, when the config dir moved
-];
-
-/**
- * Whether the `claude` binary is on this machine — on PATH, or in one of the
- * places its installers are known to put it.
- *
- * `run()` in exec.mjs can afford to hand a bare name to spawn and let the OS
- * resolve it. This cannot: it has to answer without launching anything. Boot is
- * the wrong place to spend a `claude --version` child process (quota.mjs
- * measured those at ~3.0s each), and a spawn probe would also have to decide
- * what a non-zero exit means, which is a question with no good answer. So the
- * PATH walk is done by hand, with PATHEXT applied on Windows exactly as cmd.exe
- * would — a `claude.cmd` shim from npm and a bare `claude.exe` from the native
- * installer both have to count, and neither is spelled `claude`.
- *
- * Not exported (#383). It is the first half of `hasClaudeInstalled` below, and
- * that function takes the same four injected dependencies — platform, env, home
- * and `exists` — so every branch of this walk is already driven from a test with
- * no host state reaching it, including the Windows PATHEXT branch exercised from
- * a Mac. Exporting it would offer a second, narrower answer to "is Claude Code
- * here", and the point of #402 was that there is one.
- */
-function claudeCliOnDisk({
-  platform = process.platform,
-  env = process.env,
-  home = homedir(),
-  exists = existsSync,
-} = {}) {
-  const path = platform === "win32" ? winPath : posixPath;
-  const bare = [];
-  for (const candidate of claudeCliCandidates(platform, env, home)) {
-    // A full path is worth a single stat; a bare name means "ask PATH", which
-    // is the walk below. Same split quotaClaudeBin makes, for the same reason.
-    if (candidate.includes(path.sep)) { if (exists(candidate)) return true; }
-    else bare.push(candidate);
-  }
-  if (bare.length === 0) return false;
-
-  // process.env is case-insensitive on Windows, but an injected plain object in
-  // a test is not, and %Path% is how the variable is actually spelled there.
-  const rawPath = env.PATH ?? env.Path ?? env.path ?? "";
-  // The empty extension stays in the list: a Git-Bash or WSL-style shim on
-  // Windows can be an extensionless file, and on POSIX it is the only entry.
-  const exts = platform === "win32"
-    ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").map(e => e.trim()).filter(Boolean)]
-    : [""];
-
-  for (const entry of String(rawPath).split(path.delimiter)) {
-    // Windows PATH entries are routinely quoted, and an empty entry means the
-    // current directory — which is not a place to go looking for a CLI.
-    const dir = entry.trim().replace(/^"+|"+$/g, "");
-    if (dir === "") continue;
-    for (const name of bare) {
-      for (const ext of exts) if (exists(path.join(dir, name + ext))) return true;
-    }
-  }
-  return false;
-}
-
-/**
- * Whether this machine has Claude Code at all — the mirror of hasCodexInstalled().
- *
- * README offers "Claude Code CLI or OpenAI Codex CLI (or both)", and until now
- * nothing anywhere asked which. A Codex-only machine got a Python
- * account-switcher installed for a CLI it does not have, an accounts panel open
- * on first run, and a banner telling it to sign into that CLI (#402).
- *
- * WHY TWO KINDS OF EVIDENCE, OR'd. Neither half is sufficient on its own:
- *
- *   - The binary alone misses the user whose `claude` lives somewhere no list
- *     knows (nvm, mise, volta, a corporate wrapper) and whose deck was launched
- *     from a desktop shortcut with a PATH that never sourced their shell rc.
- *     That user has run Claude Code for months; the config dir proves it.
- *   - The config dir alone misses the machine where Claude Code is installed and
- *     has never been launched, which is exactly the moment somebody installs
- *     both CLIs and starts the deck first. It also cannot be the test on its own
- *     for the opposite reason: THE DECK CREATES THAT DIRECTORY ITSELF. Hence
- *     CLAUDE_USE_MARKERS above, which is a list of things only Claude Code puts
- *     there.
- *
- * WHY NOT CREDENTIALS. A credentials file is not a presence test on macOS at
- * all — the token is in the Keychain and no file exists (#360) — so a machine
- * with Claude Code, signed in and in daily use, would read as Codex-only.
- *
- * WHY NOT "a Claude session was seen". It is the most direct evidence there is,
- * and it arrives far too late: the decision this answers is made at boot, before
- * the server is listening, and a machine whose first session has not started yet
- * would install nothing and show no panel until a restart.
- *
- * The bias is deliberate and one-way. A false yes leaves a Claude-only surface
- * on a Codex machine — today's bug, visible, and the user can pass --no-claude.
- * A false no takes the hooks away from somebody who has Claude Code, which is a
- * deck that stays empty forever. So every check here is generous, the banner
- * says out loud which way it went, and --claude overrides it.
- */
-export function hasClaudeInstalled({
-  platform = process.platform,
-  env = process.env,
-  home = homedir(),
-  configDir = claudeConfigDir(env, home),
-  exists = existsSync,
-} = {}) {
-  if (claudeCliOnDisk({ platform, env, home, exists })) return true;
-  const path = platform === "win32" ? winPath : posixPath;
-  for (const marker of CLAUDE_USE_MARKERS) {
-    if (exists(path.join(configDir, marker))) return true;
-  }
-  // ~/.claude.json is Claude Code's own state file on every install that never
-  // moved the config dir, and it sits BESIDE the home directory rather than
-  // inside ~/.claude — so the loop above cannot reach it there.
-  return exists(path.join(home, ".claude.json"));
-}

package/src/server/codex-auth.mjs

@@ -1,388 +0,0 @@
-// Codex (ChatGPT) OAuth credentials: read, refresh, persist.
-//
-// Ports the flow the Codex CLI itself uses (openai/codex, crate `codex-login`)
-// so agents-deck keeps a live token instead of going dark the moment the one
-// written by `codex login` rotates server-side.
-//
-// The important subtlety: OpenAI ROTATES the refresh token, single-use. A
-// refresh whose result does not reach disk burns the credential outright —
-// the next attempt fails with `refresh_token_reused` and the user has to run
-// `codex login` again. Everything defensive in this file follows from that:
-// refreshes are serialized, the token is re-read from disk inside the lock
-// immediately before it is spent, a response that does not clearly carry a
-// new access token is never treated as success, and nothing here throws —
-// a rejected promise from a background poll would take the server down.
-import { readFile, chmod, unlink } from "node:fs/promises";
-import { join } from "node:path";
-import { CODEX_HOME } from "./codex-dir.mjs";
-import { createTemp, renameWithRetry, resolveWriteTarget } from "./installer.mjs";
-import { PRODUCT } from "./brand.mjs";
-
-// This file used to resolve CODEX_HOME itself, as `process.env.CODEX_HOME ??
-// join(homedir(), ".codex")`. `??` falls back on null and undefined only, so an
-// empty CODEX_HOME — what `export CODEX_HOME=$SOME_UNSET_VAR` leaves in a
-// profile — survived it, and join("", "auth.json") is the CWD-relative
-// "auth.json". Of all five readers this was the expensive one to get wrong: the
-// rotated refresh token below is single-use, so a write that lands in whatever
-// directory the deck was started from does not lose a read, it burns the
-// credential and costs the user a `codex login`. codex-dir.mjs owns the rule now
-// and treats an empty value as "not set" (#375).
-const AUTH_PATH = join(CODEX_HOME, "auth.json");
-
-// Same client id + endpoint the Codex CLI uses (codex-rs/login/src/auth/manager.rs).
-const CLIENT_ID   = process.env.CODEX_APP_SERVER_LOGIN_CLIENT_ID ?? "app_EMoamEEZ73f0CkXaXp7hrann";
-const DEFAULT_REFRESH_URL = "https://auth.openai.com/oauth/token";
-
-// Registrable domains the deck is willing to hand an OpenAI credential to.
-// Deliberately a suffix list rather than a set of exact hosts: OpenAI moves
-// endpoints between subdomains, and FedRAMP tenants live on their own, so
-// pinning the four hosts in use today would break a working login on a change
-// that is none of our business. The suffix is the part that is.
-const CREDENTIAL_HOSTS = ["openai.com", "chatgpt.com"];
-
-/**
- * May a live OpenAI credential be sent to this URL?
- *
- * Both destinations in the Codex half of the deck are configurable by something
- * other than the deck — `chatgpt_base_url` in ~/.codex/config.toml, which the
- * access token is sent to, and $CODEX_REFRESH_TOKEN_URL_OVERRIDE, which the
- * SINGLE-USE refresh token is POSTed to — and neither was checked before the
- * credential went out. The Codex CLI honours the same two knobs; the difference
- * is that it is the program those credentials belong to, and the deck is a
- * bystander that reads them.
- *
- * Two rules. `https:`, so a base URL of `http://…` cannot put a bearer token on
- * the wire in cleartext. And a host at or under one of the domains above, so a
- * config file the deck does not own cannot name the recipient.
- *
- * `URL` does the parsing rather than a regex, which is what makes
- * `https://chatgpt.com@evil.example/` (userinfo, not a host) and
- * `https://chatgpt.com.evil.example/` (a different registrable domain) come out
- * as the hosts they really are.
- */
-export function isCredentialHost(raw) {
-  let u;
-  try { u = new URL(String(raw ?? "")); } catch { return false; }
-  if (u.protocol !== "https:") return false;
-  const host = u.hostname.toLowerCase();
-  return CREDENTIAL_HOSTS.some(d => host === d || host.endsWith(`.${d}`));
-}
-
-// The override is honoured only when it names somewhere the refresh token may
-// go. Falling back rather than failing outright keeps a machine with a stale or
-// mistyped override working, and the log line is there so the fallback is not
-// the silent kind.
-function refreshUrl() {
-  const override = process.env.CODEX_REFRESH_TOKEN_URL_OVERRIDE?.trim();
-  if (!override) return DEFAULT_REFRESH_URL;
-  if (isCredentialHost(override)) return override;
-  console.error(
-    `${PRODUCT} codex-auth: ignoring CODEX_REFRESH_TOKEN_URL_OVERRIDE — ` +
-    `a refresh token is only sent to https OpenAI hosts, not ${override}`,
-  );
-  return DEFAULT_REFRESH_URL;
-}
-
-// Refresh once the access token is within this much of expiring. Deliberately
-// tighter than the CLI's 5 minutes: matching it would wake both processes into
-// the same window to race for the same single-use token, and the loser gets a
-// `refresh_token_reused` that reads to the user as "your login is broken".
-const EXPIRY_SKEW_MS   = 90 * 1000;
-// Fallback only, for tokens whose `exp` we cannot read.
-const MAX_TOKEN_AGE_MS = 8 * 24 * 60 * 60 * 1000;
-
-// Refresh failures that will never succeed on retry — the credential is gone
-// and only `codex login` brings it back.
-const PERMANENT_CODES = new Set([
-  "refresh_token_expired",
-  "refresh_token_reused",
-  "refresh_token_invalidated",
-  "invalid_grant",
-]);
-
-/**
- * Decode a JWT payload. Returns null for anything that isn't a 3-part JWT.
- *
- * Exported for its test and not for a caller (#383). Its two readers are
- * `expiryMs` below — which decides whether the deck spends the single-use
- * refresh token, the one mistake in this file that costs the user a `codex
- * login` — and `identityFrom`, which reads the plan, the account id and the
- * email out of the id_token. Both take the answer from a file the deck did not
- * write and cannot validate, so every way this can be handed something that is
- * not a JWT is a real input, and neither reader can be driven far enough to
- * exercise them: `expiryMs` collapses the whole result to one number and
- * `identityFrom` needs a full auth file plus a refresh round-trip to reach.
- * See codex-jwt-decode.test.ts.
- */
-export function decodeJwt(token) {
-  if (typeof token !== "string") return null;
-  const parts = token.split(".");
-  if (parts.length !== 3 || !parts[1]) return null;
-  try {
-    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
-    return (payload && typeof payload === "object") ? payload : null;
-  } catch {
-    return null;
-  }
-}
-
-/** Access-token expiry in ms, or null when the token carries no readable `exp`. */
-function expiryMs(accessToken) {
-  const exp = decodeJwt(accessToken)?.exp;
-  return typeof exp === "number" ? exp * 1000 : null;
-}
-
-async function readAuthFile() {
-  try {
-    const parsed = JSON.parse(await readFile(AUTH_PATH, "utf8"));
-    return (parsed && typeof parsed === "object") ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Write auth.json back atomically: write a sibling tmp file, fsync it, then
- * rename over the target. A reader can never observe a half-written file, and
- * the fsync means a machine crash cannot leave an empty one behind after we
- * have already spent the old refresh token.
- *
- * Resolves symlinks first — `~/.codex/auth.json` is often a link into a
- * dotfiles repo or an encrypted volume, and renaming onto the link would
- * replace it with a regular file, quietly detaching the user's setup. That
- * resolution is the installer's resolveWriteTarget rather than a bare realpath
- * here, because settings.json needed the identical rule (#673) and a rule
- * written twice is a rule that drifts: the shared one also follows a DANGLING
- * link to the file it names, which a realpath cannot answer at all and which is
- * exactly the state a dotfiles repo is in before its first apply.
- *
- * The temp file comes from the installer's createTemp, which numbers every
- * write and creates it with O_EXCL, rather than from a name built out of the
- * pid alone. A pid names a process, not a write, so that name was one file
- * shared by every write this process makes, and the open that filled it
- * truncated whatever it found: a second refresh in flight would fill it from
- * offset zero underneath the first, and the loser would rename a splice of the
- * two over auth.json — or find its temp file already renamed away and throw
- * ENOENT. What is left at that name between runs is a live rotated refresh
- * token in cleartext, so the leftover a crashed deck strands there is not inert
- * either: a plain create adopts it whole, keeping its permissions, because
- * open() applies the mode it is given only when it is the call that creates the
- * file. O_EXCL turns a taken name into an error the caller handles instead,
- * which is also what makes the 0600 binding from the very first byte rather
- * than whatever the file it inherited happened to allow.
- *
- * The rename is the installer's retrying one because Windows fails it outright
- * with EPERM/EBUSY while another process holds auth.json open, and a virus
- * scanner, the search indexer or the Codex CLI itself does exactly that for a
- * few milliseconds at a time. Everywhere else that costs a re-download; here
- * the refresh token has already been spent server-side, so losing that
- * millisecond race logs the user out of Codex until they run `codex login`.
- *
- * Throws on failure; the caller must treat that as "the refresh did not
- * happen" rather than swallowing it.
- */
-async function persistAuth(auth) {
-  const target = await resolveWriteTarget(AUTH_PATH);
-  const { tmp, handle } = await createTemp(target, { mode: 0o600 });
-
-  let ok = false;
-  try {
-    try {
-      await handle.writeFile(JSON.stringify(auth, null, 2), "utf8");
-      await handle.sync();
-    } finally {
-      await handle.close();
-    }
-    // The umask only ever clears bits off the creation mode, so the token is
-    // never wider than 0600 — but it can land narrower, and an auth.json at
-    // 0400 is one the Codex CLI's own writer cannot open the next time it
-    // rotates. On Windows chmod's only effect is the read-only bit, and a
-    // read-only target is one no rename can replace. Pin it either way.
-    await chmod(tmp, 0o600);
-    await renameWithRetry(tmp, target);
-    ok = true;
-  } finally {
-    // A tmp left behind holds a live rotated refresh token in cleartext.
-    if (!ok) await unlink(tmp).catch(() => {});
-  }
-}
-
-/** True when the stored access token is expired, near-expiry, or stale. */
-function shouldRefresh(auth) {
-  const tokens = auth?.tokens;
-  if (!tokens?.refresh_token) return false;
-  if (!tokens.access_token) return true;
-
-  const exp = expiryMs(tokens.access_token);
-  if (exp != null) return exp <= Date.now() + EXPIRY_SKEW_MS;
-
-  // No readable expiry — fall back to how long ago the CLI last refreshed.
-  const last = auth.last_refresh ? Date.parse(auth.last_refresh) : NaN;
-  if (isNaN(last)) return false;
-  return last < Date.now() - MAX_TOKEN_AGE_MS;
-}
-
-/** Pull the failure code out of the several shapes the endpoint returns it in. */
-function refreshErrorCode(body) {
-  const raw = typeof body?.error === "object" ? body?.error?.code
-            : typeof body?.error === "string" ? body.error
-            : body?.code;
-  return typeof raw === "string" ? raw.toLowerCase() : null;
-}
-
-/**
- * Spend the refresh token. Never throws — every failure is a return value,
- * because callers include a 60s background poll whose rejection would reach
- * the HTTP router as an unhandled rejection and kill the process.
- */
-async function doRefresh(auth) {
-  let res, body;
-  try {
-    // Resolved per call, not once at import: the module is loaded lazily and a
-    // test (or an embedder) can set the override after load — the same reason
-    // ccusage.mjs reads AGENTS_DECK_NO_INSTALL per call.
-    res = await fetch(refreshUrl(), {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        client_id:     CLIENT_ID,
-        grant_type:    "refresh_token",
-        refresh_token: auth.tokens.refresh_token,
-      }),
-      signal: AbortSignal.timeout(15_000),
-    });
-    body = await res.json().catch(() => null);
-  } catch {
-    // Network error or timeout: the server may or may not have rotated the
-    // token. Nothing is written, so the next attempt retries with what we
-    // have — the only safe move when the outcome is unknown.
-    return { ok: false, reason: "refresh_failed" };
-  }
-
-  if (!res.ok) {
-    const code = refreshErrorCode(body);
-    const permanent = (code && PERMANENT_CODES.has(code)) || res.status === 401;
-    return { ok: false, reason: permanent ? "refresh_rejected" : "refresh_failed", code };
-  }
-
-  // A 2xx whose body did not survive the trip (truncated response, captive
-  // portal, proxy error page) is NOT success: writing here would persist the
-  // old, now-consumed token plus a fresh `last_refresh`, reporting a working
-  // login while guaranteeing the next call fails as `refresh_token_reused`.
-  if (typeof body?.access_token !== "string" || body.access_token === "") {
-    return { ok: false, reason: "refresh_failed", code: "no_access_token" };
-  }
-
-  // Write back only the fields that came in, leaving the rest of auth.json
-  // (OPENAI_API_KEY, auth_mode, account_id, anything unknown) untouched.
-  const next = { ...auth, tokens: { ...auth.tokens } };
-  next.tokens.access_token = body.access_token;
-  if (body.id_token)      next.tokens.id_token      = body.id_token;
-  if (body.refresh_token) next.tokens.refresh_token = body.refresh_token;
-  next.last_refresh = new Date().toISOString();
-
-  try {
-    await persistAuth(next);
-  } catch (err) {
-    // The rotated token exists server-side but never reached disk. Say so
-    // plainly — the credential on disk is now dead and only a re-login fixes
-    // it, so reporting a transient failure would just mislead.
-    console.error(`${PRODUCT} codex-auth: could not write auth.json:`, err?.message ?? err);
-    return { ok: false, reason: "refresh_rejected", code: "persist_failed" };
-  }
-
-  return { ok: true, auth: next };
-}
-
-// Refreshes run strictly one at a time per process. A queue rather than a
-// shared promise: callers that arrive during a refresh must be able to make
-// their own decision afterwards (see the staleness checks below) instead of
-// inheriting a result produced before their token failed.
-let _chain = Promise.resolve();
-function serialize(fn) {
-  const run = _chain.then(fn, fn);
-  _chain = run.then(() => {}, () => {});
-  return run;
-}
-
-/**
- * Refresh under the lock.
- *
- * `ifStale` — only refresh when the credentials on disk still look expiring.
- * `staleAccessToken` — only refresh when disk still holds the token the caller
- * saw fail. Both exist for the same reason: auth.json is re-read *inside* the
- * lock, so a caller that queued behind another refresh discovers it already
- * got what it needed and does not spend a second single-use token.
- */
-function refreshCredentials({ ifStale = false, staleAccessToken = null } = {}) {
-  return serialize(async () => {
-    const auth = await readAuthFile();
-    if (!auth?.tokens?.refresh_token) return { ok: false, reason: "no_token" };
-    if (ifStale && !shouldRefresh(auth)) return { ok: true, auth };
-    if (staleAccessToken && auth.tokens.access_token !== staleAccessToken) {
-      return { ok: true, auth };  // someone else already rotated past it
-    }
-    return doRefresh(auth);
-  });
-}
-
-function identityFrom(auth, refreshed) {
-  // Claims live in the id_token, not the access token. account_id is seeded at
-  // login into tokens.account_id; the id_token claim is the fallback for
-  // credential files written before that field existed.
-  const claims = decodeJwt(auth.tokens.id_token) ?? {};
-  const oai    = claims["https://api.openai.com/auth"] ?? {};
-  return {
-    ok:          true,
-    accessToken: auth.tokens.access_token,
-    accountId:   auth.tokens.account_id ?? oai.chatgpt_account_id ?? null,
-    isFedramp:   oai.chatgpt_account_is_fedramp === true,
-    planType:    oai.chatgpt_plan_type ?? null,
-    email:       claims.email ?? null,
-    refreshed,
-  };
-}
-
-/**
- * Current Codex credentials, refreshed if needed.
- *
- * Returns { ok: true, accessToken, accountId, … } or { ok: false, reason }
- * where reason is `no_token` (never logged in) / `refresh_rejected` (re-login
- * required) / `refresh_failed` (transient). Never throws.
- */
-export async function getCodexAuth({ allowRefresh = true } = {}) {
-  let auth = await readAuthFile();
-
-  // An `OPENAI_API_KEY` login is a platform credential, not a ChatGPT session.
-  // Flagged rather than rejected so the caller can say so plainly instead of
-  // sending the key to chatgpt.com and reporting the resulting 401 as a bug.
-  const apiKey = typeof auth?.OPENAI_API_KEY === "string" ? auth.OPENAI_API_KEY.trim() : "";
-  if (auth?.auth_mode === "apikey" || (apiKey && !auth?.tokens?.access_token)) {
-    return { ok: true, apiKeyMode: true, accessToken: null, accountId: null };
-  }
-
-  if (!auth?.tokens?.access_token) return { ok: false, reason: "no_token" };
-
-  let refreshed = false;
-  if (allowRefresh && shouldRefresh(auth)) {
-    const r = await refreshCredentials({ ifStale: true });
-    if (!r.ok) return r;
-    refreshed = r.auth.tokens.access_token !== auth.tokens.access_token;
-    auth = r.auth;
-  }
-
-  return identityFrom(auth, refreshed);
-}
-
-/**
- * Refresh because the backend rejected a token that looked valid locally —
- * OpenAI revokes server-side, so the JWT's own `exp` is not the last word.
- *
- * Pass the access token that was rejected: if disk has already moved past it
- * (a concurrent refresh, or the Codex CLI), this returns the newer credentials
- * without spending another single-use refresh token.
- */
-export async function forceCodexRefresh(rejectedAccessToken = null) {
-  const r = await refreshCredentials({ staleAccessToken: rejectedAccessToken });
-  return r.ok ? identityFrom(r.auth, true) : r;
-}